Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

garlin · 2026-08-19T11:21:18-0400

t2s50 said:
(There was a little discrepancy when I checked the winre- image with the -winre switch - your scripts reported 5247, the version read with DISM was 7548, but after having manually updated Winre.wim I no longer can reproduce that)

There's two methods for determining an image's version.

DISM will write a version number to the WIM's index when the image is captured; or you can extract the image's SOFTWARE reg hive and parse the data. I choose the 2nd method because it's more accurate in reflecting the actual patch level. Sometimes the WIM's reported version is a level lower than the final patch level.

This is why the script needs offlinereg.exe to extract the "Microsoft\Windows NT\CurrentVersion" key.

1. For a normal Windows image, the 2nd is more accurate.
2. For a WinRE, MS doesn't apparently update the UBR and pretends it's still .1

Here's a fixed script.

anchamp65 · 2026-08-19T13:32:48-0400

09:42, bug reported
10:21, fix published !

NOW THAT'S SUPPORT !!!

garlin · 2026-08-19T13:52:42-0400

I kinda suspected this WinRE version bug was present, but it helps to get confirmation from other users.
So it's just not my imagination.

otnert · 2026-08-19T20:26:43-0400

Does the script cater for USB drives created with the windows 'Recovery Drive' utility, or it's not used for this type of USB?

It's not finding the boot.wim on a freshly created recovery drive.

garlin · 2026-08-19T21:28:41-0400

otnert said:
Does the script cater for USB drives created with the windows 'Recovery Drive' utility, or it's not used for this type of USB?

It's not finding the boot.wim on a freshly created recovery drive.

That's funny. I've never seen a tool create a hidden boot.wim.

Try this fixed version.

otnert · 2026-08-20T00:04:46-0400

garlin said:
That's funny. I've never seen a tool create a hidden boot.wim.

Try this fixed version.

Yes working now...

Image Files
-----------
E:\sources\boot.wim:1 (WinRE 26100.9168)
Boot Manager [Windows UEFI CA 2023] is ALLOWED.
winload.efi is ALLOWED

The 'Recovery Drive' is created using Microsoft's own %windir%\system32\RecoveryDrive.exe utility, which automatically marks the boot.wim as hidden!

Klaver7 · 2026-08-20T00:26:17-0400

I must be lost today ...... I no longer see the boot-media with this install ISO, was made with MCT latest

(120GB SSD with patch-cord to USB)

garlin · 2026-08-20T00:47:02-0400

The rules haven't changed since yesterday:
1. A removable drive is anything that reports "Removable" or is a "CD-ROM".
2. Fixed disks must have some FAT/FAT32/exFAT filesystem, so we don't randomly scan NTFS-based fixed disks.

What filesystem is drive F?

Code:

Get-Volume -DriveLetter F

Klaver7 · 2026-08-20T00:53:14-0400

NTFS with Rufus on the end:

Code:

DriveLetter FriendlyName FileSystemType DriveType HealthStatus OperationalStatus SizeRemaining      Size
----------- ------------ -------------- --------- ------------ ----------------- -------------      ----
F           ESD-ISO      NTFS           Fixed     Healthy      OK                    105.18 GB 111.79 GB

garlin · 2026-08-20T01:00:10-0400

This drive is ignored, Fixed + NTFS. I believe you can still scan it using a drive letter.

Code:

Check_BootMedia.ps1 F:

Klaver7 · 2026-08-20T01:04:01-0400

Code:

EFI Files
---------
    SkuSiPolicy.p7b is CURRENT.

Image Files
-----------
Skipping unmounted drive F:.

PS C:\Users\

Klaver7 · 2026-08-20T01:07:14-0400

Hey it's ok I can live with it, just where you adviced me to use Rufus to write the MCT ISO to USB seems to work fine to me where the compressed swm .. something like that dont get used any more .. Thank you again

TheOzManCometh · 2026-08-20T04:22:26-0400

New member - joined mainly to say a big thank you to Garlin for all the UEFI Secure Boot file packs. My old lappy from 2019 has no OEM support but I eventually got all updated / compliant last month. Now to test / update USB recovery drives. Cheers Garlin. :)

SaliesBuzz · 2026-08-20T05:59:33-0400

Re:Bootmedia and WinRE Wim:
I have used for years Image for Windows from Terabyte Unlimited. There is a utility under their supplied software suite called "IFW-Create Recovery Boot Disk"
Every month, after the Windows Tuesday update cycle, I use this to create a USB Bootable Media, (having done a Full Backup to an external disk).
The USB stick contains the revised Wim and their Recovery program to restore any Partition that you have backed up.
The Check_BootMedia switch reports that this media has the correct 2023 Certificate:
USB Drive D: "TBWINRE"
Windows Boot Manager [Windows UEFI CA 2023] is ALLOWED.
D:\EFI\Microsoft\Boot\bootmgfw.efi
File Version: 28000.352, SVN 9.0
Over the years, (especially in the era of Hard Disks), these tools have saved my bacon on several occasions. After a disk failure, you simply install a new disk and restore the partitions.
I do not work for Terabyte Unlimited or receive any commissions from them, I am merely posting this in the hope it might help!

Solved garlin's PowerShell scripts for updating Secure Boot CA 2023

Well-known member

Attachments

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

New member

Attachments

My Computer My Computer

At a glance

Well-known member

Attachments

My Computer My Computer

At a glance

New member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Well-known member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Active member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Member

My Computer My Computer

At a glance

Similar threads

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer

My Computer